app-catalog-felhom.eu/onboarding/wger.md

Onboarding record — wger

app: wger opened: 2026-10-01 template_at: 82fff32 (wger/server:2.7; catalog main 6d72c09 when measured)

0.1 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — AGPL-3.0; image pulled from Docker Hub 0.2 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — 2.7 on 2026-09-03; repo pushed 2026-10-01; 251 open issues 0.3 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — plain x.y tags, amd64 + arm64 0.4 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt — no start-time sync or download is switched on; no outbound connection at rest; ingredient search can download from wger.de on demand (DOWNLOAD_INGREDIENTS_FROM=WGER, not measured) 0.5 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt — first start runs local migrations only 0.6 | n/a | wger serves only HTTP on port 8000; nothing else is published 0.7 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — the phone app's route: right 200 + a token that reads the API, wrong 400; wger is not gated (class 3) 0.8 | done | app-catalog-felhom.eu/templates/wger/.felhom.yml — tagline + five use_cases 0.9 | done | felhom.eu/documentation/audits/more-night-apps-2026-09-30/bench/apps/wger/bench/evidence/MV-wger/verdict.json — runs on the bench; SITE_URL builds links only 1.1 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B3-gates-now.txt — image-pins and image-resolvable exit 0 1.2 | n/a | wger keeps SQLite on its own volume, no database sidecar 1.3 | n/a | no MariaDB or PostgreSQL service in this template 1.4 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/more-night-apps-2026-09-30/box/wger/step.txt — DJANGO_PERFORM_MIGRATIONS=True; the 2.6 -> 2.7 step migrated and read back on the box 1.5 | open | the container runs manage.py runserver — WGER_USE_GUNICORN is not set (R-755; C2) 1.6 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — of 15 key-like env reads: SECRET_KEY generated, JWT pair made at start (phone route 200), DB password unused by SQLite; the rest belong to features off here (S3, mail, reCAPTCHA, OIDC, PowerSync) 1.7 | open | two entrypoint switches are still undecided: WGER_USE_GUNICORN (R-755) and DJANGO_DEBUG — unset, so collectstatic never runs (R-762; C2, C8) 1.8 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C2-static-reads.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — DEBUG False; an unknown page is a plain 404, no debug page 1.9 | n/a | SECRET_KEY signs sessions and reset links only; the JWT pair lives on the data volume and is backed up with it 2.1 | done | app-catalog-felhom.eu/audits/persistence-sweep-2026-08-02/state/gate.log — wger CLEAN (the two volumes are unchanged since) 2.2 | done | app-catalog-felhom.eu/templates/wger/docker-compose.yml — two named volumes (NVMe), no drive path 2.3 | n/a | needs_hdd false: no drive path to classify; the tier-1 unit holds both named volumes 2.4 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C8-signup-guest-media-static.txt — the app wrote its DB and a photo as user wger 2.5 | open | no backup -> remove -> restore -> read back of wger: the box has no per-app backup press outside an Update (R-648) and wger has no newer step yet (R-759) 2.6 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C7-remove.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C8b-remove-with-data.txt — both choices delete both volumes; for a no-drive app "keep data" keeps only the backups (the page says the app stored no drive data) 2.7 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C4-seed-photo-size.txt — 4.2 MB + 16 KB after the seed 2.8 | open | an uploaded photo is saved (201, file on the volume) but answers 404 through the front door — nothing serves /media/ (R-762; C4, C8) 3.1 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — class 3, measured 3.2 | done | felhom.eu/documentation/audits/login-gate-2026-09-29/D/D2-live.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — default refused, generated signs in, wrong refused 3.3 | n/a | class 3: a known default login, not an open first-run screen 3.4 | open | after the setup a stranger signed up and signed in, and each anonymous visit to the dashboard made a guest account — ALLOW_REGISTRATION and ALLOW_GUEST_USERS default True (R-763; C8) 3.5 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — 92 stranger tries from the press: 90 no route, 1 the gate, then refused; never let in 3.6 | done | felhom.eu/documentation/audits/lockouts-2026-10-01/B/B5-wger-fix-5min.txt — only the name tried is locked, 5 min; the second member unaffected (09 decision 58) 3.7 | open | not measured: changing the password and adding a family member; the template has no add_people text (R-759) 3.8 | done | app-catalog-felhom.eu/templates/wger/.felhom.yml — the password is sys.argv[1] 3.9 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C3-logins.txt — browser form with https Origin: right 302, wrong refused; phone route right 200, wrong 400 4.1 | done | app-catalog-felhom.eu/templates/wger/docker-compose.yml ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — wget to 127.0.0.1:8000, docker healthy 4.2 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B3-gates-now.txt — probe-matches-compose exit 0 4.3 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt — healthy 107 s after the press (image pull included), 0 restarts 4.4 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C5-negative-control.txt — paused: the controller read stopped within 4 s, running 40 s after; a probe-only failure (running but wrong) was not built 4.5 | done | app-catalog-felhom.eu/templates/wger/docker-compose.yml — container_name: wger, the only service 5.1 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C6-first-start-memory.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C6-wger-mem.csv — from birth, 183 s: peak anon 267 MiB = 69.5 % of 384M, swap 0, oom_kill 0 5.2 | done | felhom.eu/documentation/audits/more-night-apps-2026-09-30/bench/apps/wger/bench/evidence/MV-wger/memory-samples.json — 10 min: peak anon 49.8 %, 0 kills, 0 restarts 5.3 | done | app-catalog-felhom.eu/templates/wger/.felhom.yml — mem_limit 384M = the one service's 384M 5.4 | n/a | wger is a Python (Django) app, no self-sizing heap 5.5 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — pi_compatible true, arm64 published, ~375 MB 6.1 | done | app-catalog-felhom.eu/scripts/upgrade_fixtures_box.py — Wger: a weight entry through the login + API, with two negative controls 6.2 | done | felhom.eu/documentation/audits/more-night-apps-2026-09-30/bench/apps/wger/bench/evidence/MV-wger/verdict.json ; felhom.eu/documentation/audits/more-night-apps-2026-09-30/box/wger/step.txt — 2.6 -> 2.7 proven on both venues 6.3 | open | not measured for wger: no forced-fail undo (R-759) 6.4 | done | felhom.eu/documentation/audits/more-night-apps-2026-09-30/bench/apps/wger/bench/evidence/MV-wger/verdict.json — no mark: no file changed at start 6.5 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — x.y + x.y.0, stable 2.1 -> 2.7; pre-releases carry -dev/-alpha suffixes 7.1 | open | wger has a mail switch (ENABLE_EMAIL) and no smtp_mapping; its mail goes to the console, so a password-reset mail never leaves the box (R-764; C2) 8.1 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B3-gates-now.txt — copy-i18n exit 0 8.2 | open | not read on 9202's app page this session; add_people is absent (R-759) 8.3 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/B/B1-upstream-reads.txt — wger-logo.png and screenshot-1 answer 200 8.4 | done | app-catalog-felhom.eu/README.md — row fitness.*; FIRST-ADMIN row; category home; catalog_since set 8.5 | n/a | wger is an existing app; the count does not change 9.1 | open | the runtime volume-persistence gate was not re-run today (last CLEAN 2026-08-02); the other gates exit 0 (B3) (R-759) 9.2 | done | felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C1-install.txt ; felhom.eu/documentation/audits/new-app-checklist-2026-10-01/C/C8-signup-guest-media-static.txt — fresh installs from the drill catalog, as household and stranger 9.3 | open | 10 other rows stay open; each is a register row (R-755, R-759, R-762, R-763, R-764) 9.4 | n/a | wger is exempt: published 2026-02-15, before the checklist